Cy­ber­war­fare: The doc­trine of equiv­a­lence

The Washington Times Weekly - - Commentary -

Hack the United States with a crip­pling com­puter virus, and the Pen­tagon may re­spond with smart bombs and com­mando teams.

The mil­i­tary and in­tel­li­gence com­mu­ni­ties have known for at least two decades that “cy­ber­war” is war. Ev­ery­day ex­pe­ri­ence has con­firmed that the dig­i­tal fight is very real, as cy­ber-at­tack­ers probe and oc­ca­sion­ally crack the dig­i­tal com­mu­ni­ca­tions and data stor­age sys­tems of mil­i­tary or­ga­ni­za­tions, in­tel­li­gence agen­cies, fi­nan­cial in­sti­tu­tions and, frankly, just about ev­ery­one with a net­worked dig­i­tal de­vice.

Now the def­i­ni­tion of war­fare and mil­i­tary doc­trine, the­ory, prin­ci­ples and poli­cies that guide the use of mil­i­tary force, are catch­ing up with re­al­ity.

Ac­cord­ing to a Wall Street Jour­nal re­port last week, the Pen­tagon’s new doc­tri­nal term is “equiv­a­lence.” If a cy­berspace based at­tack in­flicts dam­age com­pa­ra­ble (equiv­a­lent) to a con­ven­tional at­tack us­ing bombs, gun­fire or beam weapons, then the cy­ber-at­tacker can ex­pect the U.S. to re- tal­i­ate with a range of weaponry, not just anti-vi­ral soft­ware or a cy­berspace-only coun­ter­at­tack.

Es­sen­tially, the U.S. mil­i­tary will no longer treat cy­berspace as a semi-mys­ti­cal gray zone some­how de­tached from the phys­i­cal world. In 21st cen­tury In­for­ma­tion Age so­ci­eties that rely on dig­i­tal de­vices for an ar­ray of crit­i­cal safety, eco­nomic and se­cu­rity ser­vices, cy­berspace pro­vides fun­da­men­tal con­nec­tiv­ity. Fun­da­men­tal re­liance cre­ates fun­da­men­tal vul­ner­a­bil­i­ties. Vul­ner­a­bil­i­ties re­quire pro­tec­tion.

De­ter­min­ing equiv­a­lence re­lies on judg­ment, and very likely a judg­ment made in the midst of a cri­sis. The odds are, how­ever, like pornog­ra­phy, you and the Joint Chiefs of Staff will know it when you see it, for ex­am­ple, when ev­ery com­puter screen in Wash­ing­ton freezes, geosyn­chronous mil­i­tary com­mu­ni­ca­tions satel­lites sud­denly fritz and die, and the en­tire East Coast’s elec­tri­cal grid stalls then quits.

Yet sim­ply sug­gest­ing a no­tional Doc­trine of Equiv­a­lence serves a valu­able pur­pose: de­ter­rence. The U.S. is in­di­cat­ing that it will not limit its re­sponse to a dig­i­tal at­tack to cy­berspace. A nation, transna­tional ter­ror or­ga­ni­za­tion, gang or even an in­di­vid­ual en­gag­ing in a cy­ber-at­tack on U.S. dig­i­tal as­sets and ca­pa­bil­i­ties risks phys­i­cal coun­ter­at­tack, a fancy way of say­ing they risk death for

The con­tin­gent lethal­ity of a cy­ber-at­tack is real; a sus­tained dig­i­tal at­tack erodes de­fense ca­pa­bil­i­ties.

wreak­ing large-scale dig­i­tal havoc.

For the last decade, de­fense and in­tel­li­gence agen­cies have been slowly creep­ing to­ward a Doc­trine of Equiv­a­lence be­tween cy­ber-at­tack and ki­netic at­tack. The rub in cy­berspace has been twofold: de­ni­a­bil­ity and lethal­ity. Cy­berspace is a vast, global jun­gle pro­vid­ing cam­ou­flage for clever snipers, crooks and armies. De­ter­min­ing where the cy­ber­shot came from can be dif­fi­cult. At­tack­ers can blame other or­ga­ni­za­tions for the as­sault.

Es­to­nia’s cy­ber­bat­tle with Rus­sia il­lus­trates the prob­lem of de­ni­a­bil­ity. In April and May 2007, Es­to­nia suf­fered a so­phis­ti­cated, sus­tained and co­or­di­nated “hack” of the coun­try’s dig­i­tal sys­tems. Es­to­nia claimed that the at­tacks orig­i­nated at the In­ter­net ad­dresses of “state agen­cies in Rus­sia.” Rus­sia de­nied the charge, at­tribut­ing the at­tacks to crim­i­nal or­ga­ni­za­tions. Were the crim­i­nals prox­ies? Es­to­nia lacked ab­so­lute proof of Rus­sian cul­pa­bil­ity.

As for lethal­ity, a dig­i­tal at­tack doesn’t leave shell craters or bleed­ing hu­man ca­su­al­ties, at least, not in the same overt sense of an as­sault with ar­tillery and bombs. But the con­tin­gent lethal­ity of a cy­ber-at­tack is real; a sus­tained dig­i­tal at­tack erodes de­fense ca­pa­bil­i­ties. De­stroy­ing spy and com­mu­ni­ca­tions satel­lites in or­der to blind and dis­rupt U.S. com­mand ca­pa­bil­i­ties is a rough equiv­a­lent.

More­over, the eco­nomic costs of a dig­i­tal at­tack can be much larger than a clas­sic bar­rage or bomb­ing cam­paign.

The in­ter­na­tional agree­ments, cus­toms and un­der­stand­ings that at­tempt to give war­fare a legal frame­work will also adapt to these 21st cen­tury con­di­tions. Treaties don’t bind rogues and fa­nat­ics, but per­cep­tion of a com­mon threat and com­mon vul­ner­a­bil­i­ties can bridge dif­fer­ences be­tween ra­tio­nal an­tag­o­nists and com­peti­tors.

The Wall Street Jour­nal re­ported that the U.S. is at­tempt­ing to reach a con­sen­sus po­si­tion with Amer­i­can al­lies on how to re­spond to cy­ber-at­tacks, though the U.S. leans to­ward the po­si­tion that hold­ing coun­tries which cre­ate cy­ber­weapons re­spon­si­ble for their use serves a de­ter­rent func­tion.

As a mem­ber of NATO and cy­ber-at­tack vic­tim, Es­to­nia will no doubt force­fully con­trib­ute to that dis­cus­sion.

Austin Bay is a na­tion­ally syn­di­cated colum­nist.

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.